Re: [PATCH v3] block: fix use-after-free on gendisk

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2019-04-02 at 20:06 +-0800, Yufen Yu wrote:
+AD4 diff --git a/block/genhd.c b/block/genhd.c
+AD4 index 961b2bc4634f..a4ef0068dbb2 100644
+AD4 --- a/block/genhd.c
+AD4 +-+-+- b/block/genhd.c
+AD4 +AEAAQA -529,6 +-529,18 +AEAAQA void blk+AF8-free+AF8-devt(dev+AF8-t devt)
+AD4         +AH0
+AD4  +AH0
+AD4  
+AD4 +-/+ACoAKg
+AD4 +- +ACo     We invalidate devt by assigning NULL pointer for devt in idr.
+AD4 +- +ACo-/
+AD4 +-void blk+AF8-invalidate+AF8-devt(dev+AF8-t devt)
+AD4 +-+AHs
+AD4 +-       if (MAJOR(devt) +AD0APQ BLOCK+AF8-EXT+AF8-MAJOR) +AHs
+AD4 +-               spin+AF8-lock+AF8-bh(+ACY-ext+AF8-devt+AF8-lock)+ADs
+AD4 +-               idr+AF8-replace(+ACY-ext+AF8-devt+AF8-idr, NULL, blk+AF8-mangle+AF8-minor(MINOR(devt)))+ADs
+AD4 +-               spin+AF8-unlock+AF8-bh(+ACY-ext+AF8-devt+AF8-lock)+ADs
+AD4 +-       +AH0
+AD4 +-+AH0

Did you perhaps copy the above code from blk+AF8-free+AF8-devt()? If so, please modify
blk+AF8-free+AF8-devt() such that it calls blk+AF8-invalidate+AF8-devt() instead of introducing a
copy of most of blk+AF8-free+AF8-devt().

Thanks,

Bart.



[Index of Archives]     [Linux RAID]     [Linux SCSI]     [Linux ATA RAID]     [IDE]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Device Mapper]

  Powered by Linux